Before installing the Website Visitors script, decide whether the planned collection and outreach are allowed for your site and audience. Tracking, company matching, and contact enrichment are different processing steps. Review each one. This checklist is operational guidance, not legal advice; ask qualified counsel to assess your jurisdictions and use case.
What should I document before installation?
Record the site and workspace, script owner, pages where it will run, data fields collected, purpose, recipients, retention period, and who can access the results. Confirm your team has authority to add the script. Keep the vendor and internal data flow in your processing inventory. Do not install it on sensitive pages without a separate review.
What notice and choices should the site provide?
Review your privacy notice and any notice at collection with counsel. Describe the tracking technology, purposes, recipients, retention, and rights in language that matches the actual configuration. Implement the consent or opt-out mechanism required where your visitors are located, and test that the script respects the visitor’s choice before collecting data. Do not assume a visitor is outside a regulated region based only on an IP address. California’s CCPA guidance explains notice and consumer rights; the UK ICO guidance covers cookies and similar tracking technology. Requirements vary by context.
How should I control the data after collection?
Limit access to staff who need the signal. Set a retention and deletion process. Make sure the team can locate the relevant records when a person exercises an applicable access, deletion, correction, or opt-out right. Do not export raw visitor data or post personal identifiers into a broadly accessible Slack channel. Review any third party destinations and agreements before turning on alerts or automated routing.
What should I check before using a visit for outreach?
Treat a company match as a candidate signal, not identification of an individual visitor. Verify the company, contact source, and business relevance. Apply suppression, prior objections, and any consent or other lawful basis required for the channel and jurisdiction. For US commercial email, review the FTC’s CAN-SPAM guidance, including accurate sender information and opt-out handling. If your site, regions, data sources, or outreach use changes, repeat the review.
For installation and signal checks, see Install website visitors and route a company.